Apache Druid before 0.23.0 vulnerable to reflected XSS via unescaped URL parameters

MITTEL 6.1CVE-2021-44791 · GHSA-8rmv-98m4-g5c6 · Published 07/07/2022 · updated 17/06/2026

Kurz gesagt

CVE-2021-44791 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in org.apache.druid:druid, druid (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.2%, höher als bei 82.7% aller Schwachstellen.
Abhilfe: auf 0.23.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.apache.druid:druid Maven	`< 0.23.0`	`0.23.0`
druid apache	`≤ 0.22.1`	No fix yet

Description

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. This issue is patched in version 0.23.0.

NVD description

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.

References

nvd.nist.gov/vuln/detail/CVE-2021-44791 · ADVISORY
apache/druid · PACKAGE
lists.apache.org/thread/lh2kcl4j45q7xj4w6rqf6kwf0mvyp2o6 · WEB

Weitere Schwachstellen in org.apache.druid:druid

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.druid:druid

Maven

< 0.23.0

0.23.0

druid

apache

≤ 0.22.1

No fix yet

Description

NVD description

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.

Weitere Schwachstellen in org.apache.druid:druid

Alle anzeigen →